@cosmicdrift/kumiko-framework 0.173.0 → 0.174.0

package/src/engine/__tests__/boot-validator.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, test } from "bun:test";
+import { describe, expect, spyOn, test } from "bun:test";
 import { z } from "zod";
 import type { SchemaTable } from "../../db/dialect";
 import { table, text } from "../../db/dialect";
@@ -590,6 +590,31 @@ describe("boot-validator", () => {
     expect(() => validateBoot(features)).not.toThrow();
   });
 
+  test("warns when a role is used by exactly one handler, reached through the real validateBoot wiring", () => {
+    const warnSpy = spyOn(console, "warn");
+    try {
+      const features = [
+        defineFeature("a", (r) => {
+          r.queryHandler("list", z.object({}), async () => [], {
+            access: { roles: ["OnlyHereRole"] },
+          });
+        }),
+      ];
+      validateBoot(features);
+      // Not toHaveBeenCalledTimes(1): this file's tests share the process-global
+      // console.warn and run with the default concurrency (bunfig.toml) — other
+      // concurrently-running tests' own "role used by one handler" warnings can
+      // land on this spy too. Assert the wiring fired at least once instead.
+      expect(
+        warnSpy.mock.calls.some((call) =>
+          (call[0] as string | undefined)?.includes("OnlyHereRole"),
+        ),
+      ).toBe(true);
+    } finally {
+      warnSpy.mockRestore();
+    }
+  });
+
   test("throws when a stream handler has no access rule", () => {
     const features = [
       defineFeature("a", (r) => {
@@ -2953,6 +2978,67 @@ describe("boot-validator — config key backing × scope", () => {
     );
   });
 
+  // framework#1708: the same params-vs-update-mode check as entityList,
+  // extended to projectionList rowActions (#1680 covered entityList only).
+  test("projectionList rowAction: navigate with params to an entityEdit target + explicit entityId → Throw", () => {
+    const feature = defineFeature("shop", (r) => {
+      r.entity("product", createEntity({ fields: { name: createTextField() } }));
+      r.screen({
+        id: "product-projection",
+        type: "projectionList",
+        query: "shop:query:products",
+        columns: ["name"],
+        rowActions: [
+          {
+            kind: "navigate",
+            id: "open",
+            label: "actions.open",
+            screen: "product-edit",
+            entityId: "name",
+            params: { pick: ["name"] },
+          },
+        ],
+      });
+      r.screen({
+        id: "product-edit",
+        type: "entityEdit",
+        entity: "product",
+        layout: { sections: [{ columns: 1, fields: ["name"] }] },
+      });
+    });
+    expect(() => validateBoot([feature])).toThrow(
+      /\(projectionList\) rowAction "open".*resolves to UPDATE mode \(explicit entityId "name"\)/,
+    );
+  });
+
+  test("projectionList rowAction: navigate with params to an entityEdit-create target (no entityId) → no throw", () => {
+    const feature = defineFeature("shop", (r) => {
+      r.entity("product", createEntity({ fields: { name: createTextField() } }));
+      r.screen({
+        id: "product-projection",
+        type: "projectionList",
+        query: "shop:query:products",
+        columns: ["name"],
+        rowActions: [
+          {
+            kind: "navigate",
+            id: "open",
+            label: "actions.open",
+            screen: "product-edit",
+            params: { pick: ["name"] },
+          },
+        ],
+      });
+      r.screen({
+        id: "product-edit",
+        type: "entityEdit",
+        entity: "product",
+        layout: { sections: [{ columns: 1, fields: ["name"] }] },
+      });
+    });
+    expect(() => validateBoot([feature])).not.toThrow();
+  });
+
   test("navigate with params targeting a cross-entity entityEdit screen (no explicit entityId) → no throw", () => {
     // The issue's actual use case: a unit row navigates to "create contract"
     // pre-filled with unitId. Different entity + no explicit entityId → the

package/src/engine/__tests__/entity-presave-wiring.integration.test.ts

@@ -8,6 +8,7 @@ import { asRawClient } from "../../db/query";
 import { setupTestStack, type TestStack, TestUsers, unsafeCreateEntityTable } from "../../stack";
 import { defineFeature } from "../define-feature";
 import { createEntity, createTextField } from "../factories";
+import { from } from "../ownership";
 
 const contactEntity = createEntity({
   table: "presave_wiring_contacts",
@@ -15,6 +16,12 @@ const contactEntity = createEntity({
     firstName: createTextField({ required: true }),
     lastName: createTextField({ required: true }),
     displayName: createTextField(),
+    // authorId is never set by the client — only deriveAuthorId (a preSave
+    // hook) writes it. secretNote's ownership rule checks authorId, so
+    // create only succeeds if the hook ran BEFORE the field-ownership check
+    // (kumiko-framework#1672 — see also event-store-executor-write.ts).
+    authorId: createTextField(),
+    secretNote: createTextField({ access: { write: { User: from("user:id", "authorId") } } }),
   },
 });
 
@@ -30,6 +37,16 @@ const deriveDisplayName: import("../types").PreSaveHookFn = async (changes, ctx)
   return { ...changes, displayName: `${first ?? ""} ${last ?? ""}`.trim() };
 };
 
+const deriveAuthorId: import("../types").PreSaveHookFn = async (changes) => ({
+  ...changes,
+  authorId: TestUsers.user.id,
+});
+
+const THROWING_HOOK_MESSAGE = "business rule violated";
+const throwOnPreSave: import("../types").PreSaveHookFn = async () => {
+  throw new Error(THROWING_HOOK_MESSAGE);
+};
+
 const contactFeature = defineFeature("presave-wiring", (r) => {
   r.crud("contact", contactEntity, {
     write: { access: { roles: ["User"] } },
@@ -41,17 +58,34 @@ const contactFeature = defineFeature("presave-wiring", (r) => {
   // handlers, so both need their own target.
   r.hook("preSave", "contact:create", deriveDisplayName);
   r.hook("preSave", "contact:update", deriveDisplayName);
+  r.hook("preSave", "contact:create", deriveAuthorId);
+  r.hook("preSave", "contact:update", deriveAuthorId);
+});
+
+const throwingEntity = createEntity({
+  table: "presave_wiring_throwing",
+  fields: { name: createTextField({ required: true }) },
+});
+
+const throwingFeature = defineFeature("presave-wiring-throw", (r) => {
+  r.crud("thing", throwingEntity, {
+    write: { access: { roles: ["User"] } },
+    read: { access: { openToAll: true } },
+  });
+  r.hook("preSave", "thing:create", throwOnPreSave);
 });
 
 const CREATE = "presave-wiring:write:contact:create";
 const UPDATE = "presave-wiring:write:contact:update";
+const THROWING_CREATE = "presave-wiring-throw:write:thing:create";
 
 describe("preSave hooks — real dispatcher path (#1672)", () => {
   let stack: TestStack;
 
   beforeAll(async () => {
-    stack = await setupTestStack({ features: [contactFeature] });
+    stack = await setupTestStack({ features: [contactFeature, throwingFeature] });
     await unsafeCreateEntityTable(stack.db, contactEntity);
+    await unsafeCreateEntityTable(stack.db, throwingEntity);
   });
 
   afterAll(async () => {
@@ -94,4 +128,22 @@ describe("preSave hooks — real dispatcher path (#1672)", () => {
     expect(updated.data.displayName).toBe("Marc Kumiko");
     expect(seenIsNew).toEqual([true, false]);
   });
+
+  test("preSave runs before ownership checks: field authz sees the hook-derived owner id", async () => {
+    const res = await stack.http.write(
+      CREATE,
+      { firstName: "Marc", lastName: "Ristone", secretNote: "psst" },
+      TestUsers.user,
+    );
+    expect(res.status).toBe(200);
+    const { data } = (await res.json()) as { data: { data: { secretNote: string } } };
+    expect(data.data.secretNote).toBe("psst");
+  });
+
+  test("a throwing preSave hook maps to a clean writeFailure, not a 500", async () => {
+    const res = await stack.http.write(THROWING_CREATE, { name: "x" }, TestUsers.user);
+    expect(res.status).toBe(422);
+    const body = (await res.json()) as { error?: { details?: { message?: string } } };
+    expect(body.error?.details?.message).toBe(THROWING_HOOK_MESSAGE);
+  });
 });

package/src/engine/__tests__/schema-builder.test.ts

@@ -131,6 +131,18 @@ describe("buildInsertSchema", () => {
       valid: { age: 5 },
       invalid: { age: 11 },
     },
+    {
+      name: "integer field rejects a value outside Postgres int4 range (must 400, not crash the DB write)",
+      fields: { attempt: createNumberField({ integer: true }) },
+      valid: { attempt: 2147483647 },
+      invalid: { attempt: 2147483648 },
+    },
+    {
+      name: "integer field with explicit max narrower than int4 still enforces the explicit bound",
+      fields: { displayOrder: createNumberField({ integer: true, max: 100 }) },
+      valid: { displayOrder: 100 },
+      invalid: { displayOrder: 101 },
+    },
     {
       name: "date field",
       fields: { born: createDateField() },
@@ -449,6 +461,23 @@ describe("buildInsertSchema", () => {
     expect(schema.safeParse({ locale: "en" }).success).toBe(true);
     expect(schema.safeParse({ locale: "xx" }).success).toBe(false);
   });
+
+  // #1712: pin omitted-key + explicit undefined — ZodPipe/optin path for defaults
+  test("optional select with default applies when key omitted or undefined", () => {
+    const entity = createEntity({
+      table: "Test",
+      fields: {
+        locale: createSelectField({ options: ["de", "en", "fr"] as const, default: "de" }),
+      },
+    });
+    const schema = buildInsertSchema(entity);
+    const omitted = schema.safeParse({});
+    expect(omitted.success).toBe(true);
+    if (omitted.success) expect(omitted.data["locale"]).toBe("de");
+    const undef = schema.safeParse({ locale: undefined });
+    expect(undef.success).toBe(true);
+    if (undef.success) expect(undef.data["locale"]).toBe("de");
+  });
 });
 
 // --- Update schema (all partial) ---

package/src/engine/__tests__/store-table.test.ts

@@ -84,6 +84,21 @@ describe("r.storeTable — declaration", () => {
     ).toThrow(/the "read_" prefix is reserved/);
   });
 
+  // #1598: registration guard — plain literal meta bypasses defineUnmanagedTable
+  test("r.storeTable rejects a plain literal meta with reserved read_ prefix", () => {
+    const literalMeta = {
+      tableName: "read_rt_probe",
+      columns: [{ name: "id", pgType: "text" as const, notNull: true, primaryKey: true }],
+      source: "unmanaged" as const,
+      indexes: [],
+    };
+    expect(() =>
+      defineFeature("probe", (r) => {
+        r.storeTable(literalMeta, { reason: "test" });
+      }),
+    ).toThrow(/the "read_" prefix is reserved/);
+  });
+
   test("accepts valid registration and stores meta + reason", () => {
     const feature = defineFeature("probe", (r) => {
       r.storeTable(probeMeta, {

package/src/engine/boot-validator/screens.ts

@@ -22,6 +22,47 @@ import type {
   ToolbarAction,
 } from "../types/screen";
 
+// Tier 2.7e navigate rowAction → target-screen params validity. Shared by
+// entityList and projectionList (framework#1708) — projectionList has no
+// `screen.entity`, so there's no same-entity row["id"] auto-fill case: any
+// entityEdit target without an explicit entityId reaches create there.
+function validateRowActionNavigateParams(
+  featureName: string,
+  screenId: string,
+  screenType: "entityList" | "projectionList",
+  screenEntity: string | undefined,
+  action: RowAction,
+  target: { readonly featureName: string; readonly screen: ScreenDefinition } | undefined,
+): void {
+  // skip: not a navigate-with-params action — nothing to validate here.
+  if (action.kind !== "navigate" || action.params === undefined) return;
+  // skip: unresolvable/custom target already reported (or exempt) elsewhere.
+  if (target === undefined || target.screen.type === "custom") return;
+
+  const isEntityEditUpdate =
+    target.screen.type === "entityEdit" &&
+    (action.entityId !== undefined ||
+      (screenEntity !== undefined && target.screen.entity === screenEntity));
+  if (
+    (target.screen.type !== "actionForm" && target.screen.type !== "entityEdit") ||
+    isEntityEditUpdate
+  ) {
+    const reason = isEntityEditUpdate
+      ? `resolves to UPDATE mode (${
+          action.entityId !== undefined
+            ? `explicit entityId "${action.entityId}"`
+            : `same entity "${screenEntity}" auto-fills row["id"]`
+        })`
+      : `screen type "${target.screen.type}"`;
+    throw new Error(
+      `[Feature ${featureName}] Screen "${screenId}" (${screenType}) rowAction "${action.id}" ` +
+        `sets params on navigate-target "${action.screen}" which ${reason} — only actionForm ` +
+        `and entityEdit-create targets read URL search params as initial values. Remove the ` +
+        `params extractor or retarget to an actionForm / cross-entity entityEdit-create screen.`,
+    );
+  }
+}
+
 // --- Screen validation ---
 //
 // For every r.screen() declaration check what's locally knowable at boot:
@@ -169,6 +210,28 @@ export function validateScreens(
       for (const col of screen.columns) {
         validateColumnRendererForm(feature.name, screenId, normalizeListColumn(col));
       }
+      if (screen.rowActions !== undefined) {
+        for (const action of screen.rowActions) {
+          if (action.kind === "navigate") {
+            const candidateQn = qualifyEntityName(feature.name, "screen", action.screen);
+            if (!allScreenQns.has(candidateQn) && !navTargetShortIds.has(action.screen)) {
+              throw new Error(
+                `[Feature ${feature.name}] Screen "${screenId}" (projectionList) rowAction "${action.id}" ` +
+                  `navigate-target "${action.screen}" does not resolve to a registered screen in any feature.`,
+              );
+            }
+            const target = screensByShortId.get(action.screen)?.[0];
+            validateRowActionNavigateParams(
+              feature.name,
+              screenId,
+              "projectionList",
+              undefined,
+              action,
+              target,
+            );
+          }
+        }
+      }
       continue;
     }
 
@@ -590,33 +653,14 @@ export function validateScreens(
             // explicit entityId) a same-entity target gets row["id"] auto-
             // injected — only a cross-entity target with no explicit
             // entityId reaches create.
-            if (
-              action.params !== undefined &&
-              target !== undefined &&
-              target.screen.type !== "custom"
-            ) {
-              const isEntityEditUpdate =
-                target.screen.type === "entityEdit" &&
-                (action.entityId !== undefined || target.screen.entity === screen.entity);
-              if (
-                (target.screen.type !== "actionForm" && target.screen.type !== "entityEdit") ||
-                isEntityEditUpdate
-              ) {
-                const reason = isEntityEditUpdate
-                  ? `resolves to UPDATE mode (${
-                      action.entityId !== undefined
-                        ? `explicit entityId "${action.entityId}"`
-                        : `same entity "${screen.entity}" auto-fills row["id"]`
-                    })`
-                  : `screen type "${target.screen.type}"`;
-                throw new Error(
-                  `[Feature ${feature.name}] Screen "${screenId}" (entityList) rowAction "${action.id}" ` +
-                    `sets params on navigate-target "${action.screen}" which ${reason} — only actionForm ` +
-                    `and entityEdit-create targets read URL search params as initial values. Remove the ` +
-                    `params extractor or retarget to an actionForm / cross-entity entityEdit-create screen.`,
-                );
-              }
-            }
+            validateRowActionNavigateParams(
+              feature.name,
+              screenId,
+              "entityList",
+              screen.entity,
+              action,
+              target,
+            );
           } else {
             if (!allWriteHandlerQns.has(action.handler)) {
               throw new Error(

package/src/engine/field-access.ts

@@ -98,15 +98,29 @@ export function checkWriteFieldRoles(
 // row. For creates, pass oldRow = undefined; the check degenerates to a
 // newRow-only evaluation.
 //
+// `submittedChanges` and `rowContext` are deliberately separate (fw#1685):
+// - `submittedChanges` drives WHICH fields get checked — only what the user
+//   actually wrote in the request. A preSave-hook-derived field the user
+//   never touched (e.g. a system hook setting `assignedTo`) must not be
+//   field-ownership-checked against the user at all.
+// - `rowContext` drives what a checked field's rule is evaluated AGAINST —
+//   this needs the full post-hook row, because an ownership rule can
+//   reference a DIFFERENT column that only a hook populates (kumiko-
+//   framework#1672: a hook derives `authorId`, a user-submitted `secretNote`
+//   field's rule is `from("user:id", "authorId")` — the check needs the
+//   hook-derived `authorId` in scope even though the user only wrote
+//   `secretNote`). Defaults to `submittedChanges` when omitted.
+//
 // Returns the denied field name for the caller to wrap into an
 // `ownership_denied` error with scope: "field", or null if all fields pass.
 export function checkWriteFieldOwnership(
   entity: EntityDefinition,
-  changes: Readonly<Record<string, unknown>>,
+  submittedChanges: Readonly<Record<string, unknown>>,
   user: SessionUser,
   oldRow?: Readonly<Record<string, unknown>>,
+  rowContext: Readonly<Record<string, unknown>> = submittedChanges,
 ): string | null {
-  for (const key of Object.keys(changes)) {
+  for (const key of Object.keys(submittedChanges)) {
     const field = entity.fields[key];
     if (!field) continue;
 
@@ -120,7 +134,7 @@ export function checkWriteFieldOwnership(
     const hasOwnershipRule = Object.values(accessMap).some((r) => r !== "all");
     if (!hasOwnershipRule) continue;
 
-    const newRow: Record<string, unknown> = { ...(oldRow ?? {}), ...changes };
+    const newRow: Record<string, unknown> = { ...(oldRow ?? {}), ...rowContext };
     const effectiveOld = oldRow ?? newRow; // create: compare against newRow
 
     if (!userCanWriteFieldRow(user, accessMap, effectiveOld, newRow)) {

package/src/engine/schema-builder.ts

@@ -109,7 +109,10 @@ export function fieldToZod(field: FieldDefinition, currencies: readonly string[]
     }
     case "number": {
       let schema = z.number();
-      if (field.integer) schema = schema.int();
+      // `integer: true` maps to a Postgres int4 column (entity-table-meta.ts)
+      // — bound it here so an out-of-range write fails loud (400) at the
+      // schema boundary instead of dying in Postgres (22003 → 500).
+      if (field.integer) schema = schema.int().min(-2147483648).max(2147483647);
       if (field.min !== undefined) schema = schema.min(field.min);
       if (field.max !== undefined) schema = schema.max(field.max);
       return field.default !== undefined ? schema.default(field.default) : schema;

package/src/entrypoint/__tests__/split-deploy.integration.test.ts

@@ -32,6 +32,11 @@ const splitFeature = defineFeature("split", (r) => {
   });
 });
 
+// Consumed by the worker's OWN eventDispatcher after worker.start() — proves
+// the write→afterCommit→MSP chain runs end-to-end inside the worker lane,
+// not just that the write itself lands in the event store (framework#1720).
+const consumedNotes: string[] = [];
+
 const workerWriteFeature = defineFeature("workerWrite", (r) => {
   const noted = r.defineEvent("noted", z.object({ note: z.string() }), { version: 1 });
   r.writeHandler(
@@ -48,8 +53,24 @@ const workerWriteFeature = defineFeature("workerWrite", (r) => {
     },
     { access: { openToAll: true } },
   );
+  r.multiStreamProjection({
+    name: "consume-notes",
+    apply: {
+      [noted.name]: async (event) => {
+        consumedNotes.push((event.payload as { note: string }).note);
+      },
+    },
+  });
 });
 
+async function waitForCondition(check: () => boolean, timeoutMs = 5000): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (!check()) {
+    if (Date.now() > deadline) throw new Error("waitForCondition: timed out");
+    await new Promise((resolve) => setTimeout(resolve, 25));
+  }
+}
+
 const JWT = "split-deploy-test-secret-must-be-32-chars!!";
 
 // Per-test queue-name with a random suffix. Date.now() alone collided
@@ -132,6 +153,8 @@ describe("entrypoint factories", () => {
       queueNamePrefix: uniquePrefix("split-dispatch"),
     });
 
+    consumedNotes.length = 0;
+    await worker.start();
     try {
       const result = await worker.dispatcher.write(
         "worker-write:write:note",
@@ -147,6 +170,11 @@ describe("entrypoint factories", () => {
       expect((rows[0] as { payload: { note: string } }).payload.note).toBe(
         "written from the worker",
       );
+
+      // The worker's own eventDispatcher (started above) picks the event
+      // back up and runs the MSP — proves the afterCommit/MSP chain works
+      // inside the worker lane, not just that the write itself succeeded.
+      await waitForCondition(() => consumedNotes.includes("written from the worker"));
     } finally {
       await worker.stop();
     }

package/src/jobs/__tests__/scheduler-id.test.ts

@@ -9,7 +9,7 @@ describe("schedulerIdForJobName", () => {
     const id = schedulerIdForJobName("publicstatus:job:uptime-probe");
     expect(id).toBe("scheduler-publicstatus-job-uptime-probe");
     expect(id.includes(":")).toBe(false);
-    expect(`repeat:${id}:1784992080000`.split(":").length).toBeLessThan(5);
+    expect(`repeat:${id}:1784992080000`.split(":").length).toBe(3);
   });
 
   test("still collapses dotted QNs", () => {

package/src/pipeline/dispatch-shared.ts

@@ -60,7 +60,7 @@ import {
   observabilityContext,
 } from "../observability";
 import { buildBucketKey } from "../rate-limit";
-import { createTzContext } from "../time";
+import { createTzContext, isValidIanaTimeZone } from "../time";
 import { appendDomainEventCore } from "./append-event-core";
 import { resolveAuthClaims as runAuthClaimsResolver } from "./auth-claims-resolver";
 import { executeQuery } from "./dispatch-query";
@@ -523,10 +523,18 @@ export async function buildHandlerContext(
   // tenant (createTzContext's own default). An app-injected GeoTzProvider
   // (context.geoTzProvider) feeds ctx.tz.fromCoordinates / fromAddress.
   const tenantTz = config !== undefined ? await config("tenant:config:timezone") : undefined;
+  // Guarded against garbage: an unvalidated string here (free-form config
+  // key, legacy JWT claim predating validation) blows up every ctx.tz call
+  // for the whole tenant with a RangeError. Fall back to UTC/tenant instead
+  // of trusting the raw value.
+  const safeTenantTz =
+    typeof tenantTz === "string" && isValidIanaTimeZone(tenantTz) ? tenantTz : "UTC";
+  const safeUserTz =
+    user.timezone !== undefined && isValidIanaTimeZone(user.timezone) ? user.timezone : undefined;
   const tz = createTzContext({
     ...(context.geoTzProvider !== undefined ? { geoTz: context.geoTzProvider } : {}),
-    tenant: typeof tenantTz === "string" ? tenantTz : "UTC",
-    ...(user.timezone !== undefined && { user: user.timezone }),
+    tenant: safeTenantTz,
+    ...(safeUserTz !== undefined && { user: safeUserTz }),
   });
 
   return {

package/src/pipeline/dispatch-stream.ts

@@ -59,12 +59,9 @@ async function* executeStreamInner(
   const invalidated = new Promise<void>((resolve) => {
     resolveInvalidated = resolve;
   });
-  const unsubscribeAccessInvalidation = ctx.sseBroker?.subscribeAccessInvalidation?.(
-    user.id,
-    () => {
-      resolveInvalidated?.();
-    },
-  );
+  const unsubscribeAccessInvalidation = ctx.sseBroker?.subscribeAccessInvalidation(user.id, () => {
+    resolveInvalidated?.();
+  });
 
   let iterator: AsyncIterator<unknown> | undefined;
   // When access is revoked mid-pull, `iterator.next()` is still in flight.

package/src/pipeline/system-hooks.ts

@@ -94,7 +94,7 @@ export function createSearchEventConsumer(
 // #1610 — subject-annotated searchable fields are ciphertext in the event
 // payload; decrypt into the derived index only. No KMS → omit ciphertext
 // values rather than indexing blobs.
-async function decryptSearchableSubjectFields(
+export async function decryptSearchableSubjectFields(
   entityName: string,
   state: Record<string, unknown>,
   registry: Registry,
@@ -116,7 +116,7 @@ async function decryptSearchableSubjectFields(
   });
 }
 
-function hasErasedSearchableSubjectField(
+export function hasErasedSearchableSubjectField(
   entityName: string,
   state: Record<string, unknown>,
   registry: Registry,
@@ -416,7 +416,7 @@ export function createAccessInvalidationEventConsumer(sseBroker: SseBroker): Eve
         // poison would otherwise permanently stop access-invalidation for
         // every user behind one bad row).
         if (typeof userId !== "string" || userId.length === 0) return;
-        sseBroker.publishAccessInvalidation?.(userId);
+        sseBroker.publishAccessInvalidation(userId);
       }
 
       if (
@@ -427,7 +427,7 @@ export function createAccessInvalidationEventConsumer(sseBroker: SseBroker): Eve
         // skip: previous snapshot missing/malformed userId — same fail-open
         // reasoning as above.
         if (userId === undefined) return;
-        sseBroker.publishAccessInvalidation?.(userId);
+        sseBroker.publishAccessInvalidation(userId);
       }
     },
   };